[PATCH net] dpaa2-eth: free the DPNI interrupt before releasing its resources

[Myeonghun Pak <mhun512@gmail.com>]

dpaa2_eth_remove() and the probe error path call fsl_mc_free_irqs(),
which returns MC interrupt resources without removing the devm-managed
handler. Until devres runs, a link or endpoint change can race with MAC
disconnection or access the freed MC portal and net device.

Add dpaa2_eth_free_irqs() to release and synchronize the handler before
returning its MC resource. Use it before disconnecting the MAC and freeing
the portal and net device in both paths.

Found by a static analysis tool under development.
Not tested on hardware.

Fixes: 6e2387e8f19e ("staging: fsl-dpaa2/eth: Add Freescale DPAA2 Ethernet driver")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---

 drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
index 7227a35dfaf2..91462b88b34a 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
@@ -4824,6 +4824,14 @@ static int dpaa2_eth_setup_irqs(struct fsl_mc_device *ls_dev)
 	return err;
 }
 
+static void dpaa2_eth_free_irqs(struct fsl_mc_device *ls_dev)
+{
+	struct fsl_mc_device_irq *irq = ls_dev->irqs[0];
+
+	devm_free_irq(&ls_dev->dev, irq->virq, &ls_dev->dev);
+	fsl_mc_free_irqs(ls_dev);
+}
+
 static void dpaa2_eth_add_ch_napi(struct dpaa2_eth_priv *priv)
 {
 	int i;
@@ -5044,7 +5052,7 @@ static int dpaa2_eth_probe(struct fsl_mc_device *dpni_dev)
 	if (priv->do_link_poll)
 		kthread_stop(priv->poll_thread);
 	else
-		fsl_mc_free_irqs(dpni_dev);
+		dpaa2_eth_free_irqs(dpni_dev);
 err_poll_thread:
 	dpaa2_eth_disconnect_mac(priv);
 err_connect_mac:
@@ -5104,7 +5112,7 @@ static void dpaa2_eth_remove(struct fsl_mc_device *ls_dev)
 	if (priv->do_link_poll)
 		kthread_stop(priv->poll_thread);
 	else
-		fsl_mc_free_irqs(ls_dev);
+		dpaa2_eth_free_irqs(ls_dev);
 
 	dpaa2_eth_disconnect_mac(priv);
 	dpaa2_eth_free_rings(priv);

base-commit: 0edbc945eb9edd0086f25b151a79cfe4adc0dfa8
-- 
2.43.0